UEFI / Bios was denn das?

Transcription

1 MIRKO COLEMBERG CONSULTANT/ MCT COLEMBERG.CH BLOG.COLEMBERG.CH / CONFIGMGR.CH UEFI / Bios was denn das? Configuration Manager

2 Reasons to Replace the BIOS 2.2 TB Drive Limit 16-bit Real Mode Lack of networking support (IPv6) Limited Option ROM Space Aging GUI OEM x64 Standardization

3 BIOS Middle Layer Hardware Device Firmware (BIOS) Device Controller System Software Application Software

4 UEFI Architecture Windows OS Option ROMs EFI OS Loader

5 UEFI Partitions (EFI) FAT32 500MB (MSR)128MB Windows (Primary) NTFS 100% of the rest Windows (Recovery) 500MB NTFS Default UEFI/GPT drive partitions Disk 0 MSR Recommended UEFI/GPT drive partitions Disk 0 Windows MSR RE tools Recovery Image No NTFS Support thats the «why» so many partitions «System» Partition also includes a TPM (simulation) GPO s for UEFI! UEFI x86 and UEFI x64 diffrent, boot with the correct WinPE

6 The GUID Partition Table Layout Primary GPT UEFI System Partition Partition Partition Partition Backup GPT GPT Protective Partition LBA 0 LBA z

7 Boot Method Comparison Legacy Boot BIOS Any OS Loader OS Start Modern Boot Native UEFI Verified OS Loader Only OS Start

8 Secure Boot Process Secure boot is a UEFI specification, not a Microsoft product! Only executes signed UEFI binary images Includes Option ROMs, pre boot utilities and OS loaders. Benefit: Helps prevent malicious code before the OS loads Benefit: Provides Time authenticated variables Benefit: Allows stronger keys for encryption

9 Early Launch Anti Malware (ELAM) Windows 7 BIOS OS Loader (Malware) 3 rd Party Drivers (Malware) Anti-Malware Software Start Windows Logon Malware is able to start before Windows and Anti-malware Windows 8 Native UEFI Windows 8 OS Loader Anti-Malware Software Start 3 rd Party Drivers Windows Logon Trusted Boot starts Anti-Malware early in the boot process

10 UEFI Technical Merits GUID Partition Table (GPT) removes the 2TB hard-drive partition limit Removes the Upper Memory Block limit for Option ROM s Unifies the Setup interface for platform firmware and Option ROM s Provides a pre-boot execution environment (not an OS) Great for diagnostics and manufacturing Can host a shell, run applications and scripts Direct access to all of memory (64-bit addressing) Direct access to bare-metal registers Network stack Easier, cleaner, more portable booting for the OS Extensible using collision-free Globally Unique ID s

11 UEFI Engineering Benefits C language firmware means faster deployments Fewer human errors; better tools; stable, re-usable code Faster time-to-market, higher quality firmware, lower system development cost Fully documented, testable interface Publicly available test suite Should help maintain stability and interoperability across implementations Consistent behavior across platforms and architectures Abstraction hides underlying architecture

12 How do I know if I m using UEFI Check the hard drive layout Check the BCD store for the version of winload.exe MSINFO32 will list the value under BIOS mode In WinPE 4.0, use the wpeutil updatebootinfo command. UEFI native BIOS / UEFI Setup BIOS UEFI with CSM Secure boot enabled UEFI native Secure boot disabled PowerShell Command Confirm-SecureBootUEFI Cmdlet not supported on this platform Result FALSE TRUE FALSE Get-SecureBootUEFI Name SetupMode Cmdlet not supported on this platform Get-SecureBootUEFI Name SecureBoot Cmdlet not supported on this platform 0 1 0

13 UEFI RELATED CONTENT UEFI Support and Requirements for Windows Operating Systems Advanced Configuration and Power Interface (ACPI) Specification Unified Extensible Firmware Interface Specification s EFI Specification 1.10 (included here for historical purposes) Unified EFI Forum Protecting the pre OS environment with UEFI the pre os environment with uefi.aspx

14 Weitere Infos MMS USA Minnesota System Center User Group (Midwest Management Summit) Hier der 20% Rabat code: SCUGSEarcessequileneyl (Nur für CMCE TN) Hotel Radisson Blu Code: MNSCUG Digicomp Kurse neu us/course.aspx?id=20695a&locale=en us us/course.aspx?id=20696a&locale=en us CM12 advanced Training with Kent Agerlund und Kaido Järvemets r2 training/

15 Danke Herzlichen Dank #cmcu_ch blog.colemberg.ch Bewertung der Session: Configmgr.ch Xing: Facebook: Linkedin: Twitter: Nächster Event: Montag 9. Februar Digicomp Basel